• bleistift2@feddit.de
    link
    fedilink
    arrow-up
    0
    ·
    1 year ago

    cleartext usernames and passwords as the URI components of GET requests

    I’m not an infrastructure person. If the receiving web server doesn’t log the URI, and supposing the communication is encrypted with TLS, which removes the credentials from the URI, are there security concerns?

    • nudelbiotop@feddit.de
      link
      fedilink
      arrow-up
      1
      ·
      edit-2
      1 year ago

      Anyone who has access to any involved network infrastructure can trace the cleartext communication and extract the credentials.

    • ItsMyFirstDay@lemmy.world
      link
      fedilink
      arrow-up
      0
      ·
      1 year ago

      I’m not 100% on this but I think GET requests are logged by default.

      POST requests, normally used for passwords, don’t get logged by default.

      BUT the Uri would get logged would get logged on both, so if the URI contained @username:Password then it’s likely all there in the logs

      • bleistift2@feddit.de
        link
        fedilink
        English
        arrow-up
        0
        ·
        1 year ago

        GET requests are logged

        That’s why I specified

        the receiving web server doesn’t log the URI

        in my question.